fix(ci): reconstruct scorecard.yml, whose uses: line was spliced into a permission

fix(ci): reconstruct scorecard.yml, whose uses: line was spliced into a permission #1359